CVE-2026-21785CWE-1021

HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy

Medium · published May 27, 2026

CVSS v3.1
4.0
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2026-05-27T20:15Z
EPSS history
Timeline
  • 27 MAY 20:15Z
    HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
    cvelistv5